Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NetBSD/etc/defaults/security.conf

49 lines
1.1 KiB
Plaintext
Raw Normal View History

Introduce a variable for security.conf, default empty, to list users whose home is (allowed to be) owned by another user. It's a separate variable and not just check_passwd_permit_dups so I can make security shut up about my uucp users. Fixes the second half of PR misc/36063
2013-11-06 23:37:05 +04:00
# $NetBSD: security.conf,v 1.26 2013/11/06 19:37:05 spz Exp $
move default config files from /etc/default -> /etc/defaults, to be consistent with what FreeBSD uses /etc/defaults for and since SVR4 uses /etc/default for another purpose. as discussed on tech-userlevel, and no objections were made.
2000-10-01 09:46:03 +04:00
#
# /etc/defaults/security.conf --
# default configuration of /etc/security.conf
#
# see security.conf(5) for more information.
remind people to edit /etc/*.conf instead of /etc/defaults/*.conf
2000-11-09 02:17:50 +03:00
#
# DO NOT EDIT THIS FILE DIRECTLY; IT MAY BE REPLACED DURING A SYSTEM UPGRADE.
# EDIT /etc/security.conf INSTEAD.
#
move default config files from /etc/default -> /etc/defaults, to be consistent with what FreeBSD uses /etc/defaults for and since SVR4 uses /etc/default for another purpose. as discussed on tech-userlevel, and no objections were made.
2000-10-01 09:46:03 +04:00
check_passwd=YES
check_group=YES
check_rootdotfiles=YES
check_ftpusers=YES
check_aliases=YES
check_rhosts=YES
check_homes=YES
check_varmail=YES
check_nfs=YES
check_devices=YES
check_mtree=YES
check_disklabels=YES
Add a chunk of code to check the installed pkgs list by making a list of all installed pkgs and their +CONTENTS and +REQUIRED_BY files (if they have one) and handling this file along with all the other CHANGELIST stuff. Greg Woods gets points for coming up with the idea. Luke Mewburn asked me to do it, and provided lots of criticism along the way.
2001-10-01 06:21:20 +04:00
check_pkgs=YES
move default config files from /etc/default -> /etc/defaults, to be consistent with what FreeBSD uses /etc/defaults for and since SVR4 uses /etc/default for another purpose. as discussed on tech-userlevel, and no objections were made.
2000-10-01 09:46:03 +04:00
check_changelist=YES
Add support for lvm to security script. Backup lvm configuration to /var/backup/lvm with other system backups. Disable lvm check until MKLVM is enabled by default. no objections on tech-userlevel@.
2009-01-27 13:32:18 +03:00
check_lvm=NO
Add the fetch_pkg_vulnerabilities option to the daily script to keep the packages vulnerability database up to date. This will only fetch the file from the server if it has changed since the last run. Add the check_pkg_vulnerabilities and check_pkg_signatures options to the security script to check that the installed packages are sane. All of these options are enabled by default but they will only run if there is, at least, one installed package.
2010-01-20 01:08:11 +03:00
check_pkg_vulnerabilities=YES
check_pkg_signatures=YES
move default config files from /etc/default -> /etc/defaults, to be consistent with what FreeBSD uses /etc/defaults for and since SVR4 uses /etc/default for another purpose. as discussed on tech-userlevel, and no objections were made.
2000-10-01 09:46:03 +04:00
Add a new variable 'backup_dir', which can be used to change the backup directory from /var/backup (useful for those of us who have a separate /var and would like to have our backup disklabels on the root filesystem). Default behaviour unchanged. backup_dir being unset is taken as /var/backup.
2001-01-09 20:30:29 +03:00
backup_dir=/var/backups
Provide the capability of storing backups via RCS instead of just a "current" and a "last" (which is useless if you wanna know what you changed last week). Set the default to on.
2001-04-04 07:17:19 +04:00
backup_uses_rcs=YES
Use $diff_options when running diff in /etc/security. Default diff_options to -u, for unified-format context diffs, because context is essential to a useful evaluation of differences. This represents a behavior change. Implements change-request PR security/17247 from Takahiro Kambe <taca@sky.yamashina.kyoto.jp>.
2003-02-22 01:47:51 +03:00
diff_options=-u
Add a new variable 'backup_dir', which can be used to change the backup directory from /var/backup (useful for those of us who have a separate /var and would like to have our backup disklabels on the root filesystem). Default behaviour unchanged. backup_dir being unset is taken as /var/backup.
2001-01-09 20:30:29 +03:00
check_homes_permit_usergroups=NO
2003-11-18 06:21:40 +03:00
check_homes_permit_usergroups=NO
Introduce a variable for security.conf, default empty, to list users whose home is (allowed to be) owned by another user. It's a separate variable and not just check_passwd_permit_dups so I can make security shut up about my uucp users. Fixes the second half of PR misc/36063
2013-11-06 23:37:05 +04:00
check_homes_permit_other_owner=""
check_homes_permit_usergroups=NO
2003-11-18 06:21:40 +03:00
don't check ntfs and msdosfs for devices/set[ug]id files; neither of those are supported on the filesystem, so no need for checking PR: 33092 by Aleksey Cheusov
2006-04-01 21:13:19 +04:00
check_devices_ignore_fstypes="!local fdesc kernfs null procfs ptyfs ntfs msdos"
Implement check_devices_ignore_paths, which is a list of paths to avoid traversing during check_devices.
2006-05-25 06:38:10 +04:00
check_devices_ignore_paths=""
PR misc/7716: add configuration options find_core_ignore_fstypes and check_devices_ignore_fstypes to allow the filesystem types that are ignored during the daily and security runs to be adjusted.
2004-09-28 19:03:58 +04:00
Under check_mtree, invoke mtree with -L if check_mtree_follow_symlinks is set. Apparently mtree -L is imperfect, but it is far better than the lack thereof if symlinks are involved reaching files mtree verifies.
2003-02-13 05:42:06 +03:00
check_mtree_follow_symlinks=NO
PR/36732 - Jim Bernard -- delete /usr/libexec/uucp/uucico from list of shells
2007-08-05 04:10:37 +04:00
check_passwd_nowarn_shells="/sbin/nologin"
Add some flexibility to /etc/security, by way of security.conf options: check_passwd_nowarn_shells Don't warn about these non-/etc/shells shells check_passwd_nowarn_users Don't warn about these users check_passwd_permit_star Don't warn about "*" in the $2 field Behavior change: check_passwd_nowarn_shells defaults to /sbin/nologin and /usr/libexec/uucp/uucico, so that it will not warn about the default master.passwd. The rationale here is that an administrator who chooses to permit these warnable conditions should not be warned about them day after day, yet should not be forced to disable check_passwd entirely. check_passwd_permit_star is primarily of interest to sites who use *'d entries for Kerberos or ssh logins, despite the fact that we permit "*ssh" (etc.) for this purpose (legacy).
2003-02-13 04:55:10 +03:00
check_passwd_nowarn_users=""
change security so that there is a configuration value for the list of users who will not be considered for duplicate uid check. Seed it with 'toor' in defaults/security.conf.
2012-04-05 13:09:27 +04:00
check_passwd_permit_dups="toor"
Add some flexibility to /etc/security, by way of security.conf options: check_passwd_nowarn_shells Don't warn about these non-/etc/shells shells check_passwd_nowarn_users Don't warn about these users check_passwd_permit_star Don't warn about "*" in the $2 field Behavior change: check_passwd_nowarn_shells defaults to /sbin/nologin and /usr/libexec/uucp/uucico, so that it will not warn about the default master.passwd. The rationale here is that an administrator who chooses to permit these warnable conditions should not be warned about them day after day, yet should not be forced to disable check_passwd entirely. check_passwd_permit_star is primarily of interest to sites who use *'d entries for Kerberos or ssh logins, despite the fact that we permit "*ssh" (etc.) for this purpose (legacy).
2003-02-13 04:55:10 +03:00
check_passwd_permit_star=NO
add a check_passwd_permin_nonalpha option, which changes the passwd test to permit non-alphanumeric characters in login names
2005-02-05 18:26:37 +03:00
check_passwd_permit_nonalpha=NO
Make max_loginlen and max_grouplen 16. We've handled 16 character logins for quite some time, and we even have packages that create >8 character accounts. There is no point in pretending the limit is 8 any more by default. Discussed (very lightly -- there was little comment) on tech-userlevel
2005-08-22 18:09:23 +04:00
max_loginlen=16
max_grouplen=16